feat(obs): add metrics runtime controller status (#3408)

docs/architecture/background-controller-contract.md

@@ -138,6 +138,20 @@ allocator reclaim loop. Existing backend-specific force handling, idle-streak
 logic, metrics emission, and runtime-token shutdown behavior remain owned by the
 current loop.
 
+## BGC-006 Metrics Runtime Status And Controller Surface
+
+The third low-risk controller/status surface is metrics runtime. It reports the
+service name, observability metrics enablement, collector task count, configured
+collector intervals, replication bandwidth zero-tombstone cycle count,
+runtime-token cancellation state, and the absence of a dedicated shutdown
+handle.
+
+The only allowed worker mutation for this surface is `none`. Reconcile output is
+read-only and must not start, stop, resize, wake, or otherwise drive metrics
+collector tasks. Existing collector grouping, interval parsing, metrics
+emission, replication bandwidth tombstone handling, and runtime-token shutdown
+behavior remain owned by the current loops.
+
 ## Future Reconcile Rules
 
 Future reconcile work is allowed only after a read-only status snapshot exists.

docs/architecture/background-services-inventory.md

@@ -47,7 +47,7 @@ not define a new scheduler, controller framework, or shutdown contract.
 | Notification runtime | `rustfs/src/server/event.rs::init_event_notifier` initializes live event stream support even when notification targets are disabled; when enabled, it loads server config and activates targets. Config reload uses `NotificationConfigManager::reload_config`. | Installs ECStore event dispatch hook, activates notification targets, manages replay/runtime target state, and supports live event streams. | Notification module state is refreshed from persisted module switches; target health is available through runtime target status. | Keep live event stream support separate from target delivery enablement. Reload must remain admin-triggered and peer-signaled. |
 | Audit runtime | `rustfs/src/server/audit.rs::start_audit_system` starts audit only when module switches and configured targets allow it. `AuditSystem::reload_config` replaces runtime targets. | Dispatches audit events to configured targets and manages replay workers. | Audit observability records config reloads and target delivery metrics. | Do not couple audit lifecycle to notification lifecycle even though the runtime patterns are similar. |
 | Dynamic config reload | Admin config handlers call `apply_dynamic_config_for_subsystem`, then `signal_dynamic_config_reload` or `signal_config_snapshot_reload` through the global notification system. | Applies scanner/heal runtime config, audit reloads, notification reloads, and peer reload signals. | Logs local and peer reload failures. Audit reload increments audit config reload metrics. | This is admin-triggered fanout, not a background scheduler. Controller work should preserve per-subsystem validation and error boundaries. |
-| Metrics runtime | `crates/obs/src/metrics/scheduler.rs::init_metrics_runtime` spawns multiple interval loops for cluster, bucket, node, resource, audit, notification, and replication bandwidth metrics. | Periodically collects and reports metrics. | Reports through the metrics runtime and logs cancellation warnings. | Keep intervals and collector grouping stable while adding status snapshots. |
+| Metrics runtime | `crates/obs/src/metrics/scheduler.rs::init_metrics_runtime` spawns multiple interval loops for cluster, bucket, node, resource, audit, notification, and replication bandwidth metrics. | Periodically collects and reports metrics. | Reports through the metrics runtime, logs cancellation warnings, and exposes a typed read-only status snapshot plus a no-op reconcile plan for enablement, collector task count, intervals, replication bandwidth tombstone cycles, cancellation source, and shutdown handle shape. | Keep intervals and collector grouping stable. The current controller surface does not mutate workers. |
 | Memory observability | `rustfs/src/memory_observability.rs::init_memory_observability` spawns a token-cancelled sampler. | Periodically records memory snapshots. | Emits memory observability metrics and exposes a read-only status snapshot plus a no-op reconcile plan for metrics enablement, interval, cancellation source, and shutdown handle shape. | This is the first low-risk pilot for controller status because it already has a simple token loop and the pilot does not mutate workers. |
 | Allocator reclaim | `rustfs/src/allocator_reclaim.rs::init_allocator_reclaim` spawns a token-cancelled reclaim loop when enabled. | Observes reclaimable work and may run allocator reclaim after idle intervals. | Emits reclaim enabled/backend counters, active-request gauges, scanner/heal activity gauges, and reclaim result counters. Exposes a typed read-only status snapshot plus a no-op reconcile plan for enablement, backend, effective force, intervals, cancellation source, and shutdown handle shape. | A controller must preserve idle-streak logic and backend-specific force behavior. The current controller surface does not mutate workers. |
 | Auto-tuner | `rustfs/src/init.rs::init_auto_tuner` optionally spawns a 60-second loop when `RUSTFS_AUTOTUNER_ENABLED` is true. | Tunes concurrency manager settings from performance metrics. | Logs iteration success/failure. | Treat as behavior-sensitive; a future controller needs explicit rollback because it can change runtime concurrency. |

docs/architecture/migration-progress.md

@@ -5,18 +5,16 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
 ## Current Context
 
 - Issue: [`rustfs/backlog#660`](https://github.com/rustfs/backlog/issues/660)
-- Branch: `overtrue/arch-background-controller-harness-and-status`
-- Baseline: `origin/main` at `624de3114398338c80b87c9b452fc70b1d76fa8a`
+- Branch: `overtrue/arch-metrics-runtime-controller-status`
+- Baseline: `origin/main` at `76b375c478a8c2f5c79e62e848156a55915ed769`
 - PR type for this branch: `behavior-change`
-- Runtime behavior changes: none; the allocator reclaim controller/status
-  surface only returns read-only snapshot/reconcile data and never starts,
-  stops, resizes, or wakes workers.
-- Rust code changes: add allocator reclaim status/controller snapshots,
-  reconcile plans with explicit no-op worker mutation, and controller harness
-  tests for memory observability plus allocator reclaim.
+- Runtime behavior changes: none; the metrics runtime controller/status surface
+  only returns read-only snapshot/reconcile data and never starts, stops,
+  resizes, or wakes collectors.
+- Rust code changes: add metrics runtime status/controller snapshots and
+  reconcile plans with explicit no-op worker mutation.
 - CI/script changes: none.
-- Docs changes: record `TEST-BGC-001` harness coverage and the allocator reclaim
-  controller/status slice.
+- Docs changes: record `BGC-006` metrics runtime controller/status scope.
 
 ## Phase 0 Tasks
 
@@ -417,27 +415,37 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
     and startup call shape.
   - Verification: focused allocator reclaim tests, compile checks, formatting,
     migration guards, Rust risk scan, and pre-commit quality gate.
+- [x] `BGC-006` Add metrics runtime controller/status surface.
+  - Acceptance: metrics runtime exposes typed desired/status/controller
+    snapshots and a typed reconcile plan that reports observability enablement,
+    collector task count, configured intervals, runtime cancellation, shutdown
+    handle shape, and no-op worker mutation.
+  - Must preserve: existing metrics collector grouping, interval parsing,
+    replication bandwidth tombstone cycles, metrics emission, runtime-token
+    cancellation, and startup call shape.
+  - Verification: focused metrics runtime tests, compile checks, formatting,
+    migration guards, Rust risk scan, and pre-commit quality gate.
 
 ## Next PRs
 
-1. `behavior-change`: add the next low-risk background status surface before
-   broader reconcile work.
-2. `test-only`: add config-reload preservation coverage for scanner/heal/
+1. `test-only`: add config-reload preservation coverage for scanner/heal/
    lifecycle/replication in `TEST-BGC-002`.
+2. `behavior-change`: add another low-risk read-only status surface only after
+   preserving config-reload and shutdown assumptions.
 
 ## Pre-Push Review Log
 
 | Expert | Status | Notes |
 |---|---|---|
-| Quality/architecture | pass | Confirmed allocator reclaim follows the established typed desired/status/reconcile shape without adding a generic scheduler, registry, or admin route. |
-| Migration preservation | pass | Confirmed reconcile reports `worker_mutation: none`, preserving enablement, force handling, idle-streak logic, cancellation, and metrics emission behavior. |
+| Quality/architecture | pass | Confirmed metrics runtime follows the established typed desired/status/reconcile shape without adding a generic scheduler, registry, or admin route. |
+| Migration preservation | pass | Confirmed reconcile reports `worker_mutation: none`, preserving collector grouping, interval parsing, tombstone cycles, cancellation, and metrics emission behavior. |
 | Testing/verification | pass | Focused tests, compile checks, formatting, diff hygiene, migration guards, Rust risk scan, and `make pre-commit` passed. |
 
 ## Verification Notes
 
-Passed on `624de3114398338c80b87c9b452fc70b1d76fa8a`:
-- `cargo test -p rustfs allocator_reclaim --lib`; 9 passed.
-- `cargo test -p rustfs memory_observability --lib`; 9 passed.
+Passed on `76b375c478a8c2f5c79e62e848156a55915ed769`:
+- `cargo test -p rustfs-obs metrics_runtime --lib`; 4 passed.
+- `cargo check -p rustfs-obs`.
 - `cargo check -p rustfs --lib`.
 - `cargo fmt --all`.
 - `cargo fmt --all --check`.
@@ -445,20 +453,20 @@ Passed on `624de3114398338c80b87c9b452fc70b1d76fa8a`:
 - `./scripts/check_architecture_migration_rules.sh`.
 - `./scripts/check_layer_dependencies.sh`.
 - `./scripts/check_metrics_migration_refs.sh`.
-- Rust risk scan for changed Rust files; only test `expect` calls and existing
-  internal allocator reclaim `Result<(), String>` helpers matched.
-- `make pre-commit`; all checks passed, including nextest 5874 passed and 111
+- Rust risk scan for changed Rust files; only an existing doc-comment
+  `println!` example and an existing bounded scheduler numeric cast matched.
+- `make pre-commit`; all checks passed, including nextest 5880 passed and 111
   skipped.
 
 Notes:
 - This slice adds reconcile/status data only. It does not apply reconcile output
-  to the running allocator reclaim loop or memory observability sampler.
+  to the running metrics collectors.
 - There is no admin/API exposure in this PR; future controller harness work
   should stay isolated from scanner, heal, lifecycle, and replication.
 
 ## Handoff Notes
 
-- Next migration slice can start another read-only low-risk status surface or
-  `TEST-BGC-002` config-reload preservation coverage.
+- Next migration slice should start `TEST-BGC-002` config-reload preservation
+  coverage before broader controller surfaces.
 - Keep scanner, heal, lifecycle, replication, disk health, and config reload out
   of broad controller movement until dedicated preservation tests exist.